Skip to content

chore(deps): update dependencies #336

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 2 commits into
base: main
Choose a base branch
from
Open

chore(deps): update dependencies #336

renovate wants to merge 2 commits into from
+366 −346

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Dec 29, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@t3-oss/env-nextjs (source) 0.13.8 → 0.13.10 age adoption passing confidence
@types/node (source) 24.10.1 → 24.10.8 age adoption passing confidence
discord-api-types (source) 0.38.36 → 0.38.37 age adoption passing confidence
fumadocs-typescript (source) 4.0.13 → 4.0.14 age adoption passing confidence
lucide-react (source) 0.555.0 → 0.562.0 age adoption passing confidence
react (source) 19.2.1 → 19.2.3 age adoption passing confidence
react-dom (source) 19.2.1 → 19.2.3 age adoption passing confidence
ws 8.18.3 → 8.19.0 age adoption passing confidence
zod (source) 4.1.13 → 4.3.5 age adoption passing confidence

Release Notes

t3-oss/t3-env (@​t3-oss/env-nextjs)

v0.13.10

Compare Source

Patch Changes

v0.13.9

Compare Source

Patch Changes
discordjs/discord-api-types (discord-api-types)

v0.38.37

Compare Source

fuma-nama/fumadocs (fumadocs-typescript)

v4.0.14

Compare Source

Patch Changes
  • f728e67: Support customising full type with @fumadocsType tag
  • Updated dependencies [da87713]
  • Updated dependencies [d17499b]
    • fumadocs-core@​16.2.4
    • fumadocs-ui@​16.2.4
lucide-icons/lucide (lucide-react)

v0.562.0

Compare Source

v0.561.0: Version 0.561.0

Compare Source

What's Changed

Full Changelog: lucide-icons/lucide@0.560.0...0.561.0

v0.560.0: Version 0.560.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.559.0...0.560.0

v0.559.0: Version 0.559.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.558.0...0.559.0

v0.558.0: Version 0.558.0

Compare Source

What's Changed

Full Changelog: lucide-icons/lucide@0.557.0...0.558.0

v0.557.0: Version 0.557.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.556.0...0.557.0

v0.556.0: Version 0.556.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.555.0...0.556.0

facebook/react (react)

v19.2.3: 19.2.3 (December 11th, 2025)

Compare Source

React Server Components

v19.2.2: 19.2.2 (December 11th, 2025)

Compare Source

React Server Components
websockets/ws (ws)

v8.19.0

Compare Source

Features

  • Added the closeTimeout option (#​2308).

Bug fixes

  • Handled a forthcoming breaking change in Node.js core (1998485).
colinhacks/zod (zod)

v4.3.5

Compare Source

Commits:

v4.3.4

Compare Source

Commits:

v4.3.3

Compare Source

v4.3.2

Compare Source

v4.3.1

Compare Source

Commits:

  • 0fe8840 allow non-overwriting extends with refinements. 4.3.1

v4.3.0

Compare Source

This is Zod's biggest release since 4.0. It addresses several of Zod's longest-standing feature requests.

z.fromJSONSchema()

Convert JSON Schema to Zod (#​5534, #​5586)

You can now convert JSON Schema definitions directly into Zod schemas. This function supports JSON Schema "draft-2020-12", "draft-7", "draft-4", and OpenAPI 3.0.

import * as z from "zod";

const schema = z.fromJSONSchema({
  type: "object",
  properties: {
    name: { type: "string", minLength: 1 },
    age: { type: "integer", minimum: 0 },
  },
  required: ["name"],
});

schema.parse({ name: "Alice", age: 30 }); // ✅

The API should be considered experimental. There are no guarantees of 1:1 "round-trip soundness": MySchema > z.toJSONSchema() > z.fromJSONSchema(). There are several features of Zod that don't exist in JSON Schema and vice versa, which makes this virtually impossible.

Features supported:

  • All primitive types (string, number, integer, boolean, null, object, array)
  • String formats (email, uri, uuid, date-time, date, time, ipv4, ipv6, and more)
  • Composition (anyOf, oneOf, allOf)
  • Object constraints (additionalProperties, patternProperties, propertyNames)
  • Array constraints (prefixItems, items, minItems, maxItems)
  • $ref for local references and circular schemas
  • Custom metadata is preserved

z.xor() — exclusive union (#​5534)

A new exclusive union type that requires exactly one option to match. Unlike z.union() which passes if any option matches, z.xor() fails if zero or more than one option matches.

const schema = z.xor([z.string(), z.number()]);

schema.parse("hello"); // ✅
schema.parse(42);      // ✅
schema.parse(true);    // ❌ zero matches

When converted to JSON Schema, z.xor() produces oneOf instead of anyOf.

z.looseRecord() — partial record validation (#​5534)

A new record variant that only validates keys matching the key schema, passing through non-matching keys unchanged. This is used to represent patternProperties in JSON Schema.

const schema = z.looseRecord(z.string().regex(/^S_/), z.string());

schema.parse({ S_name: "John", other: 123 });
// ✅ { S_name: "John", other: 123 }
// only S_name is validated, "other" passes through

.exactOptional() — strict optional properties (#​5589)

A new wrapper that makes a property key-optional (can be omitted) but does not accept undefined as an explicit value.

const schema = z.object({
  a: z.string().optional(),      // accepts `undefined`
  b: z.string().exactOptional(), // does not accept `undefined`
});

schema.parse({});                  // ✅
schema.parse({ a: undefined });    // ✅
schema.parse({ b: undefined });    // ❌

This makes it possible to accurately represent the full spectrum of optionality expressible using exactOptionalPropertyTypes.

.apply()

A utility method for applying arbitrary transformations to a schema, enabling cleaner schema composition. (#​5463)

const setCommonChecks = <T extends z.ZodNumber>(schema: T) => {
  return schema.min(0).max(100);
};

const schema = z.number().apply(setCommonChecks).nullable();

.brand() cardinality

The .brand() method now accepts a second argument to control whether the brand applies to input, output, or both. Closes #​4764, #​4836.

// output only (default)
z.string().brand<"UserId">();           // output is branded (default)
z.string().brand<"UserId", "out">();    // output is branded
z.string().brand<"UserId", "in">();     // input is branded
z.string().brand<"UserId", "inout">();  // both are branded

Type predicates on .refine() (#​5575)

The .refine() method now supports type predicates to narrow the output type:

const schema = z.string().refine((s): s is "a" => s === "a");

type Input = z.input<typeof schema>;   // string
type Output = z.output<typeof schema>; // "a"

ZodMap methods: min, max, nonempty, size (#​5316)

ZodMap now has parity with ZodSet and ZodArray:

const schema = z.map(z.string(), z.number())
  .min(1)
  .max(10)
  .nonempty();

schema.size; // access the size constraint

.with() alias for .check() (359c0db)

A new .with() method has been added as a more readable alias for .check(). Over time, more APIs have been added that don't qualify as "checks". The new method provides a readable alternative that doesn't muddy semantics.

z.string().with(
  z.minLength(5),
  z.toLowerCase()
);

// equivalent to:
z.string().check(
  z.minLength(5),
  z.trim(),
  z.toLowerCase()
);
z.slugify() transform

Transform strings into URL-friendly slugs. Works great with .with():

// Zod
z.string().slugify().parse("Hello World");           // "hello-world"

// Zod Mini
// using .with() for explicit check composition
z.string().with(z.slugify()).parse("Hello World");   // "hello-world"

z.meta() and z.describe() in Zod Mini (947b4eb)

Zod Mini now exports z.meta() and z.describe() as top-level functions for adding metadata to schemas:

import * as z from "zod/mini";

// add description
const schema = z.string().with(
  z.describe("A user's name"),
);

// add arbitrary metadata
const schema2 = z.number().with(
  z.meta({ deprecated: true })
);

New locales

import * as z from "zod";
import { uz } from "zod/locales";

z.config(uz());





Bug fixes

All of these changes fix soundness issues in Zod. As with any bug fix there's some chance of breakage if you were intentionally or unintentionally relying on this unsound behavior.

⚠️ .pick() and .omit() disallowed on object schemas containing refinements (#​5317)

Using .pick() or .omit() on object schemas with refinements now throws an error. Previously, this would silently drop the refinements, leading to unexpected behavior.

const schema = z.object({
  password: z.string(),
  confirmPassword: z.string(),
}).refine(data => data.password === data.confirmPassword);

schema.pick({ password: true });
// 4.2: refinement silently dropped ⚠️
// 4.3: throws error ❌

Migration: The easiest way to migrate is to create a new schema using the shape of the old one.

const newSchema = z.object(schema.shape).pick({ ... })
⚠️ .extend() disallowed on refined schemas (#​5317)

Similarly, .extend() now throws on schemas with refinements. Use .safeExtend() if you need to extend refined schemas.

const schema = z.object({ a: z.string() }).refine(/* ... */);

// 4.2: refinement silently dropped ⚠️
// 4.3: throws error ✅
schema.extend({ b: z.number() });
// error: object schemas containing refinements cannot be extended. use `.safeExtend()` instead.
⚠️ Stricter object masking methods (#​5581)

Object masking methods (.pick(), .omit()) now validate that the keys provided actually exist in the schema:

const schema = z.object({ a: z.string() });

// 4.3: throws error for unrecognized keys
schema.pick({ nonexistent: true });
// error: unrecognized key: "nonexistent"

Additional changes

  • Fixed JSON Schema generation for z.iso.time with minute precision (#​5557)
  • Fixed error details for tuples with extraneous elements (#​5555)
  • Fixed includes method params typing to accept string | $ZodCheckIncludesParams (#​5556)
  • Fixed numeric formats error messages to be inclusive (#​5485)
  • Fixed implementAsync inferred type to always be a promise (#​5476)
  • Tightened E.164 regex to require a non-zero leading digit and 7–15 digits total (#​5524)
  • Fixed Dutch (nl) error strings (#​5529)
  • Convert Date instances to numbers in minimum/maximum checks (#​5351)
  • Improved numeric keys handling in z.record() (#​5585)
  • Lazy initialization of ~standard schema property (#​5363)
  • Functions marked as @__NO_SIDE_EFFECTS__ for better tree-shaking (#​5475)
  • Improved metadata tracking across child-parent relationships (#​5578)
  • Improved locale translation approach (#​5584)
  • Dropped id uniqueness enforcement at registry level (#​5574)

v4.2.1

Compare Source

v4.2.0

Compare Source

Features

Implement Standard JSON Schema

standard-schema/standard-schema#134

Implement z.fromJSONSchema()
const jsonSchema = {
  type: "object",
  properties: {
    name: { type: "string" },
    age: { type: "number" }
  },
  required: ["name"]
};

const schema = z.fromJSONSchema(jsonSchema);
Implement z.xor()
const schema = z.xor(
  z.object({ type: "user", name: z.string() }),
  z.object({ type: "admin", role: z.string() })
);
// Exactly one of the schemas must match
Implement z.looseRecord()
const schema = z.looseRecord(z.string(), z.number());
// Allows additional properties beyond those defined

Commits:

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 12:59 AM, every 7 days ( * 0 */7 * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Dependency updates!! label Dec 29, 2025
@renovate renovate bot requested review from a team and thewilloftheshadow as code owners December 29, 2025 00:49
@renovate renovate bot added the dependencies Dependency updates!! label Dec 29, 2025
@renovate renovate bot enabled auto-merge December 29, 2025 00:49
@changeset-bot
Copy link

changeset-bot bot commented Dec 29, 2025 •
edited
Loading

🦋 Changeset detected

Latest commit: 4dd2f4f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@buape/carbon Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions github-actions bot added the package: carbon The carbon package label Dec 29, 2025
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Dec 29, 2025

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Comment @coderabbitai help to get the list of available commands and usage tips.

@socket-security
Copy link

socket-security bot commented Dec 29, 2025 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedfumadocs-typescript@​4.0.13 ⏵ 4.0.149710072 +193100
Updatedreact@​19.2.1 ⏵ 19.2.31001008497 +1100
Updated@​t3-oss/​env-nextjs@​0.13.8 ⏵ 0.13.10100 +110089 +393100
Updatedreact-dom@​19.2.1 ⏵ 19.2.31001009298 +1100
Updatedlucide-react@​0.555.0 ⏵ 0.562.0100 +110095 +194100
Updateddiscord-api-types@​0.38.36 ⏵ 0.38.37100 +110010095 -3100
Updated@​types/​node@​24.10.1 ⏵ 24.10.8100 +1100100 +20100 +5100

View full report

@socket-security
Copy link

socket-security bot commented Dec 29, 2025 •
edited
Loading

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@renovate renovate bot force-pushed the renovate/dependencies branch 20 times, most recently from 3adf196 to 4a6d6da Compare January 3, 2026 00:34
@renovate renovate bot force-pushed the renovate/dependencies branch 27 times, most recently from b681d28 to 2627eac Compare January 13, 2026 20:27
@renovate renovate bot force-pushed the renovate/dependencies branch from 0bbf7dc to 6af71be Compare January 14, 2026 02:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@thewilloftheshadow thewilloftheshadow Awaiting requested review from thewilloftheshadow thewilloftheshadow is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Dependency updates!! package: carbon The carbon package

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@buapebot